Virus Size

[Suicyco247]

I've saw this topic touched upon but a search never returned a definitive answer.
I know viruses are usually pretty small files, but will a corupted file appear slightly larger than a clean one? And can a verified hash become corrupted if there are multiple sources for the same file? If a corrupted file does appear to be the same size can you give a brief explanation why?

[Sherlock_Holmes]

Originally posted by Suicyco247@3 April 2003 - 11:00
I've saw this topic touched upon but a search never returned a definitive answer.
I know viruses are usually pretty small files, but will a corupted file appear slightly larger than a clean one? And can a verified hash become corrupted if there are multiple sources for the same file? If a corrupted file does appear to be the same size can you give a brief explanation why?

Because a virus is just a piece of code that is attached to a file, this would in fact increase the original size of the file by a few bytes, or even more, depending on what type of virus it is. On the other hand, there are viruses that delete certain parts of files and then add another piece of code in its place, theoretically keeping the file at the same size - so the answer to that questions is yes and no. That small change in the files structure is what antivirus programmes look for. There are also viruses that do not attach themselves to files, they are small files in theirselves that execute upon certain conditions.

Your other question as regards verified hashes is beyond my knowledge.

Peace
S.Holmes